var symbols = Module.enumerateSymbolsSync("libart.so");
var addrNewStringUTF = null;
for (var i = 0; i < symbols.length; i++) {
    var symbol = symbols[i];

    if (symbol.name.indexOf("NewStringUTF") >= 0 && symbol.name.indexOf("CheckJNI") < 0) {
        addrNewStringUTF = symbol.address;
        console.log("NewStringUTF is at ", symbol.address, symbol.name);
        // break
    }
}


if (addrNewStringUTF != null) {
    Interceptor.attach(addrNewStringUTF, {
        onEnter: function (args) {
            var c_string = args[1];
            var dataString = c_string.readCString();
			
            if (dataString.indexOf("XYAAAAAQAAAAEAAAB") !== -1) {
                console.log(dataString);

                // 下边这个Thread这是输出它在当前的NewStringUTF它是在哪个so文件里去触发的
                // console.log(Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n') + '\n');
                console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
                
            }
        }
    });
}

// frida -UF  -l  2_NewStringUTF.js